INCIDENT 2026-09-01 18:58:50 trigger: php_rss=1606MB ================================================================== load: 1.28 1.18 1.15 8/760 3292277 ncpu:10 mem_avail: 6130MB/13777MB (44.5%) swap_used:2489MB swapout:11/s blocked(D):0 running:9 iowait:0.1% steal:0.0% php: 15 procs / 1606MB heaviest user: madalice (5 procs, 751MB) apache: 131 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3341 nobody 130 2104 root 243 954 madalice 5 751 alison 6 585 netdata 7 206 otterfencing 1 114 cpanellogin 1 112 mailman 20 84 wp-toolkit 3 81 dovenull 6 46 lowrange 3 41 mailnull 4 37 infinium 2 27 evolution 7 26 zabbix 1 19 dovecot 3 18 kurri 1 13 named 1 12 polkitd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 5 751 alison 6 575 otterfencing 1 115 root 1 32 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5265 MB Active(file): 4292 MB Inactive(file): 946 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 479 MB CommitLimit: 10984 MB Committed_AS: 10473 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 16:36:21 4836 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3421676 11.0 Ssl 4-16:39:41 /usr/sbin/mariadbd 508924 1 netdata 186488 1.9 Ssl 4-16:39:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2001035 3930335 root 171756 0.1 S 06:03:34 spamd child 3291936 3929444 madalice 163792 11.4 S 00:23 php-fpm: pool madalice_com_au 3291940 3929444 madalice 160052 17.5 S 00:22 php-fpm: pool madalice_com_au 3291943 3929444 madalice 157640 15.4 S 00:22 php-fpm: pool madalice_com_au 3292136 3929444 madalice 156260 16.5 S 00:13 php-fpm: pool madalice_com_au 3963222 3930335 root 150248 0.0 S 16:28:33 spamd child 3292151 3929444 madalice 131352 10.0 S 00:13 php-fpm: pool madalice_com_au 3292242 3292113 otterfencing 124948 56.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509266 1 root 121816 0.0 Ss 4-16:39:07 /usr/lib/systemd/systemd-journald 3292243 3292031 alison 121032 90.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2552785 1353308 cpanellogin 115440 0.0 S 03:29:41 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3292246 3292030 alison 99664 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3292245 3292110 alison 97608 65.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3930335 1 root 85360 0.0 Ss 16:35:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3292247 3292011 alison 83428 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3292248 3292025 alison 79768 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 61148 0.0 Sl 4-16:39:05 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 51752 0.0 Sl 4-16:39:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929420 1 wp-toolkit 45452 0.0 Ss 16:36:12 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42084 0.1 Ss 41-16:17:33 cpsrvd (SSL) - waiting for connections 3929444 1 root 33696 0.0 Ss 16:36:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3929564 1 wp-toolkit 33304 0.0 Ss 16:36:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3929532 1 root 23640 0.0 Ss 16:36:11 lfd - sleeping 3290218 506832 nobody 21224 0.0 S 02:46 /usr/sbin/httpd -k start 3274877 506832 nobody 20988 0.0 S 04:46 /usr/sbin/httpd -k start 1469 1 root 20776 0.1 Ss 64-08:49:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3290197 506832 nobody 20652 0.0 S 02:46 /usr/sbin/httpd -k start 1463 1 root 20644 0.0 Ss 64-08:49:02 tailwatchd 3290194 506832 nobody 20264 0.0 S 02:46 /usr/sbin/httpd -k start 3291679 506832 nobody 19884 0.1 S 00:51 /usr/sbin/httpd -k start 3290169 506832 nobody 19808 0.0 S 02:47 /usr/sbin/httpd -k start 3290174 506832 nobody 19572 0.0 S 02:47 /usr/sbin/httpd -k start 483898 1 zabbix 19568 0.2 Ssl 4-16:40:24 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3292029 506832 nobody 19516 0.0 S 00:16 /usr/sbin/httpd -k start 3292011 506832 nobody 19484 0.1 S 00:17 /usr/sbin/httpd -k start 3292032 506832 nobody 19468 0.1 S 00:16 /usr/sbin/httpd -k start 3290199 506832 nobody 19448 0.0 S 02:46 /usr/sbin/httpd -k start 3292027 506832 nobody 19372 0.0 S 00:16 /usr/sbin/httpd -k start 3292025 506832 nobody 19308 0.0 S 00:16 /usr/sbin/httpd -k start 3292026 506832 nobody 19184 0.0 S 00:16 /usr/sbin/httpd -k start 3290179 506832 nobody 19016 0.0 S 02:47 /usr/sbin/httpd -k start 3292103 506832 nobody 18936 0.0 S 00:13 /usr/sbin/httpd -k start 3292128 506832 nobody 18928 0.0 S 00:13 /usr/sbin/httpd -k start 3290148 506832 nobody 18804 0.0 S 02:48 /usr/sbin/httpd -k start 3292110 506832 nobody 18624 0.2 S 00:13 /usr/sbin/httpd -k start 3292005 506832 nobody 18464 0.0 S 00:18 /usr/sbin/httpd -k start 3292095 506832 nobody 18364 0.1 S 00:14 /usr/sbin/httpd -k start 3292009 506832 nobody 18340 0.0 S 00:17 /usr/sbin/httpd -k start 3292031 506832 nobody 18328 0.0 S 00:16 /usr/sbin/httpd -k start 3292048 506832 nobody 18288 0.0 S 00:15 /usr/sbin/httpd -k start 3292122 506832 nobody 18284 0.0 S 00:13 /usr/sbin/httpd -k start 3292030 506832 nobody 18272 0.0 S 00:16 /usr/sbin/httpd -k start 3292120 506832 nobody 18272 0.0 S 00:13 /usr/sbin/httpd -k start 3292028 506832 nobody 18252 0.1 S 00:16 /usr/sbin/httpd -k start 3292040 506832 nobody 18244 0.0 S 00:15 /usr/sbin/httpd -k start 3292118 506832 nobody 18216 0.0 S 00:13 /usr/sbin/httpd -k start 3292124 506832 nobody 18212 0.0 S 00:13 /usr/sbin/httpd -k start 3292033 506832 nobody 18192 0.0 S 00:16 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15197800 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 271 customkidscom/customkids.com.au-ssl_log 260 bigdeals/bigdeals.com.au 193 evolution/app.evolutionerp.com.au-ssl_log 104 bigdeals/bigdeals.com.au-ssl_log 83 evolution/portal.evolutionerp.com.au-ssl_log 30 alison/alisonarts.com.au-ssl_log 11 evolution/my.evolutionerp.com.au-ssl_log 11 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 260 34.92.15.6 236 68.155.159.216 193 185.177.72.24 104 40.115.94.245 83 158.23.18.78 33 203.54.180.238 18 49.196.215.77 6 35.185.102.31 4 114.119.143.226 3 203.56.128.202 3 147.161.213.78 3 114.119.130.40 2 180.181.236.49 2 118.127.40.55 2 114.75.63.177 --- top request paths across all vhosts (last 3 min) --- 66 GET /cgi-sys/suspendedpage.cgi 52 GET /api/getItem/LWHG2001KG 52 GET /api/getItem/LWFBW2001KG 30 GET /heartbeat.php 20 POST / 11 GET / 9 POST /functions.php 9 POST /cgi-sys/suspendedpage.cgi 4 GET /store/blue-butterfly-premium-pack-limited/ 3 POST /api/v1/validate/code 3 GET /index.php 2 POST /wp-admin/admin-ajax.php 2 GET /wp-mail.php 2 GET /wp-login.php 2 GET /system_log.php 2 GET /simple.php 2 GET /p.php 2 GET /php.php 2 GET /mac.php 2 GET /lock360.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 14 POST / 7 GET / 4 GET /store/blue-butterfly-premium-pack-limited/ 2 POST /wp-admin/admin-ajax.php 1 POST /wp-json/wc-push-notifications/send 1 GET /zup.php73 1 GET /zup.php 1 GET /z.php 1 GET /zoom1.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /x.php -- last 10 requests -- 114.119.146.16 - - [01/Sep/2026:18:58:36 +1000] "GET /store/blue-butterfly-premium-pack-limited/?rating=2&wcpr_rating=2 HTTP/1.1" 200 51301 "https://madalice.com.au/store/blue-butterfly-premium-pack-limited/?rating=2&wcp 203.56.128.202 - - [01/Sep/2026:18:58:37 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/store/bling-nike-crew-socks/?srsltid=AfmBOooe4XH9FQhYQbei8dBpQGDr-7dnOi4VZf8rXcvDcuf7Hs9E 203.56.128.202 - - [01/Sep/2026:18:58:37 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/bling-nike-crew-socks/?srsltid=AfmBOooe4XH9FQhYQbei8dBpQGDr-7dnOi4VZf8rXcvDcuf 68.155.159.216 - - [01/Sep/2026:18:58:38 +1000] "GET /wp-includes/ HTTP/1.1" 400 44 "-" "-" 49.196.215.77 - - [01/Sep/2026:18:58:33 +1000] "POST /?wc-ajax=checkout HTTP/1.1" 200 113 "https://madalice.com.au/checkout-2/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 68.155.159.216 - - [01/Sep/2026:18:58:39 +1000] "GET /wp-trackback.php HTTP/1.1" 400 44 "-" "-" 118.127.40.55 - - [01/Sep/2026:18:58:38 +1000] "POST /wp-json/wc-push-notifications/send HTTP/1.1" 200 20 "-" "WordPress/7.1; https://madalice.com.au" 68.155.159.216 - - [01/Sep/2026:18:58:40 +1000] "GET /ws.php HTTP/1.1" 403 13 "-" "-" 68.155.159.216 - - [01/Sep/2026:18:58:40 +1000] "GET /.bod/.ll/ HTTP/1.1" 400 44 "-" "-" 49.196.215.77 - - [01/Sep/2026:18:58:39 +1000] "GET /checkout-2/order-received/34715/?key=wc_order_Kr3qHTK8rRbqF HTTP/1.1" 200 44524 "https://madalice.com.au/checkout-2/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/5 == customkidscom/customkids.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:52 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:53 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.15.6 - - [01/Sep/2026:18:57:53 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == bigdeals/bigdeals.com.au == -- top paths -- 66 GET /cgi-sys/suspendedpage.cgi 9 POST /cgi-sys/suspendedpage.cgi 3 POST /api/v1/validate/code 2 POST / 2 GET / 1 POST /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 POST /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 POST /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php 1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 POST /RSC/R/t5aiyczsy3klzf9.txt 1 POST /RSC/e80a0na7liaruhh.txt 1 POST /_rsc -- last 10 requests -- 185.177.72.24 - - [01/Sep/2026:18:57:15 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:15 +1000] "GET /v1/kv/?recurse=true HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:16 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:17 +1000] "GET /v1/catalog/services HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:17 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:18 +1000] "GET /version HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:18 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:19 +1000] "GET /v2/keys/?recursive=true HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:19 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:57:20 +1000] "GET /api/health HTTP/1.1" 302 250 "-" "curl/8.7.1" --- last 30 samples (run-up to this incident) --- 2026-09-01 18:56:20 L1=0.94 run=3 blk=0 avail=7030 (51.0%) swpO=0 conn=1 myRSS=3341 php=5 phpRSS=618 ap=98 tcp=35 topuser=madalice 2026-09-01 18:56:29 L1=0.79 run=5 blk=0 avail=7049 (51.2%) swpO=0 conn=3 myRSS=3341 php=7 phpRSS=706 ap=89 tcp=27 topuser=madalice 2026-09-01 18:56:30 L1=0.79 run=3 blk=0 avail=7194 (52.2%) swpO=0 conn=1 myRSS=3341 php=5 phpRSS=511 ap=88 tcp=28 topuser=madalice 2026-09-01 18:56:39 L1=0.91 run=1 blk=0 avail=7245 (52.6%) swpO=0 conn=3 myRSS=3341 php=6 phpRSS=549 ap=79 tcp=30 topuser=madalice 2026-09-01 18:56:40 L1=0.91 run=1 blk=0 avail=7264 (52.7%) swpO=0 conn=1 myRSS=3341 php=5 phpRSS=509 ap=78 tcp=30 topuser=madalice 2026-09-01 18:56:49 L1=0.92 run=1 blk=0 avail=7316 (53.1%) swpO=0 conn=3 myRSS=3341 php=6 phpRSS=551 ap=69 tcp=31 topuser=madalice 2026-09-01 18:56:50 L1=0.92 run=1 blk=0 avail=7338 (53.3%) swpO=0 conn=1 myRSS=3341 php=5 phpRSS=510 ap=68 tcp=28 topuser=madalice 2026-09-01 18:56:59 L1=0.85 run=2 blk=0 avail=7372 (53.5%) swpO=0 conn=3 myRSS=3341 php=6 phpRSS=551 ap=59 tcp=34 topuser=madalice 2026-09-01 18:57:01 L1=0.85 run=1 blk=0 avail=7261 (52.7%) swpO=0 conn=1 myRSS=3341 php=6 phpRSS=666 ap=58 tcp=37 topuser=madalice 2026-09-01 18:57:09 L1=0.72 run=1 blk=0 avail=7719 (56.0%) swpO=0 conn=3 myRSS=3341 php=4 phpRSS=239 ap=49 tcp=27 topuser=madalice 2026-09-01 18:57:11 L1=0.72 run=3 blk=0 avail=7611 (55.2%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=359 ap=48 tcp=27 topuser=corpkicks 2026-09-01 18:57:19 L1=0.84 run=2 blk=0 avail=7775 (56.4%) swpO=0 conn=3 myRSS=3341 php=4 phpRSS=235 ap=39 tcp=33 topuser=madalice 2026-09-01 18:57:21 L1=0.84 run=5 blk=0 avail=7691 (55.8%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=339 ap=38 tcp=46 topuser=madalice 2026-09-01 18:57:29 L1=1.23 run=1 blk=0 avail=7756 (56.3%) swpO=0 conn=2 myRSS=3341 php=5 phpRSS=360 ap=30 tcp=31 topuser=madalice 2026-09-01 18:57:31 L1=1.23 run=4 blk=0 avail=7779 (56.5%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=320 ap=29 tcp=31 topuser=madalice 2026-09-01 18:57:39 L1=1.04 run=1 blk=0 avail=7843 (56.9%) swpO=0 conn=2 myRSS=3341 php=5 phpRSS=359 ap=20 tcp=26 topuser=madalice 2026-09-01 18:57:41 L1=1.04 run=1 blk=0 avail=7855 (57.0%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=320 ap=19 tcp=26 topuser=madalice 2026-09-01 18:57:49 L1=0.96 run=1 blk=0 avail=7935 (57.6%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=237 ap=18 tcp=26 topuser=madalice 2026-09-01 18:57:51 L1=0.96 run=5 blk=0 avail=7893 (57.3%) swpO=0 conn=2 myRSS=3341 php=6 phpRSS=353 ap=18 tcp=27 topuser=madalice 2026-09-01 18:58:00 L1=1.03 run=1 blk=0 avail=7958 (57.8%) swpO=0 conn=2 myRSS=3341 php=3 phpRSS=196 ap=19 tcp=29 topuser=madalice 2026-09-01 18:58:01 L1=1.03 run=1 blk=0 avail=7968 (57.8%) swpO=0 conn=2 myRSS=3341 php=3 phpRSS=196 ap=19 tcp=30 topuser=madalice 2026-09-01 18:58:10 L1=1.04 run=3 blk=0 avail=7905 (57.4%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=298 ap=17 tcp=27 topuser=madalice 2026-09-01 18:58:11 L1=1.04 run=2 blk=0 avail=7965 (57.8%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=238 ap=17 tcp=26 topuser=madalice 2026-09-01 18:58:20 L1=1.18 run=2 blk=0 avail=7922 (57.5%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=295 ap=15 tcp=27 topuser=madalice 2026-09-01 18:58:21 L1=1.17 run=2 blk=0 avail=7979 (57.9%) swpO=0 conn=2 myRSS=3341 php=4 phpRSS=234 ap=15 tcp=27 topuser=madalice 2026-09-01 18:58:30 L1=1.16 run=5 blk=0 avail=7453 (54.1%) swpO=0 conn=4 myRSS=3341 php=6 phpRSS=701 ap=15 tcp=27 topuser=madalice 2026-09-01 18:58:31 L1=1.06 run=1 blk=0 avail=7672 (55.7%) swpO=0 conn=2 myRSS=3341 php=5 phpRSS=548 ap=17 tcp=135 topuser=madalice 2026-09-01 18:58:40 L1=1.06 run=3 blk=0 avail=6557 (47.6%) swpO=0 conn=4 myRSS=3341 php=8 phpRSS=880 ap=141 tcp=115 topuser=madalice 2026-09-01 18:58:41 L1=1.13 run=2 blk=0 avail=6661 (48.4%) swpO=0 conn=2 myRSS=3341 php=7 phpRSS=766 ap=140 tcp=81 topuser=madalice 2026-09-01 18:58:50 L1=1.28 run=9 blk=0 avail=6130 (44.5%) swpO=11 conn=8 myRSS=3341 php=15 phpRSS=1606 ap=131 tcp=40 topuser=madalice